Trojan.Downloader.Dofoil

Dofoil is a family of Trojan downloaders, including variants like TROJ_DOFOIL.GE. While Dofoil is consistent in its behavior of downloading and installing other threats automatically, the nature of its payload varies from rogue security software to spyware and file-locking Trojans. September was a particularly high month for Dofoil's distribution, which utilized spam e-mail attachments to gain access to new systems. Anti-malware products capable of detecting and deleting multiple high-level threats simultaneously are favored for removing Dofoil and other threats that Dofoil may download.

Dofoil: the 'Windows File' that Invites Trojans into Your PC

Dofoil is a Trojan downloader, or a Trojan that specializes in installing other threats, such as banking Trojans, worms, rootkits or spyware. Because Dofoil's functions are useful for distributing different types of threats, Dofoil may be used by unrelated persons to distribute different threats in completely separate campaigns. While this business model makes Dofoil's ultimate payloads somewhat unpredictable, malware experts can provide some examples of threatening software installed by Dofoil, including:

• Security Scanner is a fraudulent PC security suite, based on the WinWebSec family. Security Scanner may block real security features or display misleading pop-up warnings.
• TSPY_SPCESEND is a spyware program that password-protects Microsoft Office documents, and also may transfer them to third parties.

The Dofoil also is known for two essentially fraudulent characteristics: using the file names of real Windows files and injecting its code into the memory processes of unrelated applications. Both of these functions make identifying Dofoil by sight difficult and may cause careless PC users to delete a Windows component while trying to track down the source of their infections. In some cases, Dofoil, like most Trojan downloaders, also may be instructed to uninstall itself (but not, necessarily, the other threats Dofoil may install.

Foiling a Dofoil Trojan's Attack

Some of the popular disguises of Dofoil Trojans may include dxdiag.exe, ctfmon.exe and gefreg.exe. Since files bearing such names are normal components of the Windows OS, you should avoid deleting them or trying to remove Dofoil by yourself. Dedicated anti-malware products should scan any Dofoil-infected PC to uninstall both Dofoil and its payloads. By default, Dofoil injects its code into the Svchost.exe process and by monitoring that process for any unusual behavior may allow you to spot some of the minor symptoms of Dofoil infections.

As is normally the case, malware researchers rate preventing Dofoil infections much simpler than uninstalling Dofoil afterward. With the Dofoil family's continual focus on e-mail-based distribution exploits, you should be cautious about any e-mail messages that bear the traditional hallmarks of a Trojan attack. Requests to open a file attachment, files mislabeled with inappropriate format extensions, links to insecure websites and Microsoft documents hosting macro vulnerabilities are some of the clearest signs of an e-mail Trojan's aggression. Updated anti-malware software should be capable of detecting corrupted files and links that could lead to Dofoil's installation, but preventing the possibility at all is in everyone's best interests.

Technical Details